The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2022-6854 https://linux.oracle.com/errata/ELSA-2022-6854.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: gnutls-3.7.6-12.el9_0.i686.rpm gnutls-3.7.6-12.el9_0.x86_64.rpm gnutls-c++-3.7.6-12.el9_0.i686.rpm gnutls-c++-3.7.6-12.el9_0.x86_64.rpm gnutls-dane-3.7.6-12.el9_0.i686.rpm gnutls-dane-3.7.6-12.el9_0.x86_64.rpm gnutls-devel-3.7.6-12.el9_0.i686.rpm gnutls-devel-3.7.6-12.el9_0.x86_64.rpm gnutls-utils-3.7.6-12.el9_0.x86_64.rpm nettle-3.8-3.el9_0.i686.rpm nettle-3.8-3.el9_0.x86_64.rpm nettle-devel-3.8-3.el9_0.i686.rpm nettle-devel-3.8-3.el9_0.x86_64.rpm aarch64: gnutls-3.7.6-12.el9_0.aarch64.rpm gnutls-c++-3.7.6-12.el9_0.aarch64.rpm gnutls-dane-3.7.6-12.el9_0.aarch64.rpm gnutls-devel-3.7.6-12.el9_0.aarch64.rpm gnutls-utils-3.7.6-12.el9_0.aarch64.rpm nettle-3.8-3.el9_0.aarch64.rpm nettle-devel-3.8-3.el9_0.aarch64.rpm SRPMS: https://oss.oracle.com:443/ol9/SRPMS-updates/gnutls-3.7.6-12.el9_0.src.rpm https://oss.oracle.com:443/ol9/SRPMS-updates/nettle-3.8-3.el9_0.src.rpm Related CVEs: CVE-2022-2509 Description of changes: gnutls [3.7.6-12] - fips: mark PBKDF2 with short key and output sizes non-approved - fips: only mark HMAC as approved in PBKDF2 - fips: mark gnutls_key_generate with short key sizes non-approved - fips: fix checking on hash algorithm used in ECDSA - fips: preserve operation context around FIPS selftests API [3.7.6-11] - Supply --with{,out}-{zlib,brotli,zstd} explicitly [3.7.6-10] - Revert nettle version pinning as it doesn't work well in side-tag [3.7.6-9] - Pin nettle version in Requires when compiled with FIPS [3.7.6-8] - Bundle GMP to privatize memory functions - Disable certificate compression support by default [3.7.6-7] - Update gnutls-3.7.6-cpuid-fixes.patch [3.7.6-6] - Mark RSA SigVer operation approved for known modulus sizes (#2119770) - accelerated: clear AVX bits if itcannot be queried through XSAVE [3.7.6-5] - Block DES-CBC usage in decrypting PKCS#12 bag under FIPS (#2115314) - sysrng: reseed source DRBG for prediction resistance [3.7.6-4] - Make gnutls-cli work with KTLS for testing - Fix double-free in gnutls_pkcs7_verify (#2109789) [3.7.6-3] - Limit input size for AES-GCM according to SP800-38D (#2108635) - Do not treat GPG verification errors as fatal - Remove gnutls-3.7.6-libgnutlsxx-const.patch [3.7.6-2] - Allow enabling KTLS with config file (#2108532) [3.7.6-1] - Update to gnutls 3.7.6 (#2102591) [3.7.3-10] - Use only the first component of VERSION from /etc/os-release (#2076626) - Don't run power-on self-tests on DSA (#2076627) nettle [3.8-3] - Rebuild in new side-tag [3.8-2] - Bundle GMP to privatize memory functions - Zeroize stack allocated intermediate data [3.8-1] - Update to nettle 3.8 (#2100350) _______________________________________________ El-errata mailing list
An update for nettle is now available for Red Hat Enterprise Linux 7.3 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: nettle security update Advisory ID: RHSA-2021:2760-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:2760 Issue date: 2021-07-19 CVE Names: CVE-2021-20305 ==================================================================== 1. Summary: An update for nettle is now available for Red Hat Enterprise Linux 7.3 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server AUS (v. 7.3) - x86_64 3. Description: Nettle is a cryptographic library that is designed to fit easily in almost any context: In crypto toolkits for object-oriented languages, such as C++, Python, or Pike, in applications like LSH or GNUPG, or even in kernel space. Security Fix(es): * nettle: Out of bounds memory access in signature verification (CVE-2021-20305) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1942533 - CVE-2021-20305 nettle: Out of bounds memory access in signatureverification 6. Package List: Red Hat Enterprise Linux Server AUS (v. 7.3): Source: nettle-2.7.1-9.el7_3.src.rpm x86_64: nettle-2.7.1-9.el7_3.i686.rpm nettle-2.7.1-9.el7_3.x86_64.rpm nettle-debuginfo-2.7.1-9.el7_3.i686.rpm nettle-debuginfo-2.7.1-9.el7_3.x86_64.rpm nettle-devel-2.7.1-9.el7_3.i686.rpm nettle-devel-2.7.1-9.el7_3.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-20305 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYPUvm9zjgjWX9erEAQjzhhAAotSdw1OwugWKwn1+WsDPK6cT2rEKPG3c Z7uqwpc39wMlBf5MKh7Gj5U6c9XJFuVwHLaGshJ8oTOQLVAV1m7ftPeYHSnPZ3nd 04nPpkdthgk7x6e5fhbtTLVmu3NjQ4ggWCvLo6aQ0ogrfuS1YtvIMerbGFUJuKyZ hPSZR48QQ7GuATFbYM6B+rO+aMTLwlxYwqfqTl99SLwel+030+gS7T1GDeX45LTq 9yTj6GB8rg9VeWQbfLO0c7OyyHL/Xrl/jo18H9UDGZyFYAveISVYuojnHP8/d88Z BEbivMKI8ihsY0Qyn7BVuvsLAePwE4UOxG92DjWxluoAnLe+zav0gFgT5nT8xfur k1v4WcfqVAmeBQNPTi0PvVv4jiEvJcv2hhBreYz+UBcmIqbJkAIc/OMpG32dnWaw Ov+gfy6IeJ+k54yugWcEEFWG+ExXZPBCZ71qo7wIQ9rNQLMVssAqWXYEpWpd4YIh lgETV0+1M8I0MYv0Dp+gDWAGzDyhsVLR6EIE2ckKf610Ltji/5MeXUFCRBf7fUid sCN+VZi0CE32nM93AUZrHImReg1HMmXm7cVf/yk24f+rG31c9PCNe/XbVnFAbOZH 3hv/sWkoH8rEiLAjanJTXYtScVodJkJq7dyhHZtl12EiLOE2hotjoUkR7ewudmgA 0C71DSruiGI=XFOF -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Get the latest Linux and open source security news straight to your inbox.